mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-26 04:15:48 -06:00
Peter Steinberger
4dc7bb7411
* chore(deps): refresh dependencies after cooldown * fix(gateway): emit append-only Responses content events * chore(deps): retain unverified Sherpa runtime
72 lines
2.5 KiB
Bash
Executable File
72 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -euo pipefail
|
|
|
|
source_root="${1:?trusted Vercel CLI source root is required}"
|
|
destination="${2:?Vercel CLI destination is required}"
|
|
github_output="${3:-}"
|
|
|
|
package_json="${source_root}/package.json"
|
|
package_lock="${source_root}/package-lock.json"
|
|
expected_lock_sha256="7a1aaa3017353437cd8908c50034d6c1f54899c9c9d92f289b06ccb26532848a"
|
|
expected_vercel_integrity="sha512-oLctNaFB5bptskV4gioZQ6Ac4E0fDbKKU/q/JX1H+lz7IWgsTgKafwxvfJHJiCANEH5syl7a9H1IxxGN7Dp8dg=="
|
|
test -f "${package_json}"
|
|
test -f "${package_lock}"
|
|
if [[ -e "${destination}" || -L "${destination}" ]]; then
|
|
echo "Vercel CLI destination must not already exist: ${destination}" >&2
|
|
exit 1
|
|
fi
|
|
|
|
install -d -m 0700 "${destination}"
|
|
install -m 0600 "${package_json}" "${destination}/package.json"
|
|
install -m 0600 "${package_lock}" "${destination}/package-lock.json"
|
|
|
|
lock_sha256="$(
|
|
VERCEL_CLI_LOCK="${package_lock}" \
|
|
node -e "const { createHash } = require('node:crypto'); const { readFileSync } = require('node:fs'); process.stdout.write(createHash('sha256').update(readFileSync(process.env.VERCEL_CLI_LOCK)).digest('hex'));"
|
|
)"
|
|
[[ "${lock_sha256}" == "${expected_lock_sha256}" ]] || {
|
|
echo "Pinned Vercel CLI lock SHA-256 mismatch." >&2
|
|
exit 1
|
|
}
|
|
vercel_integrity="$(
|
|
VERCEL_CLI_LOCK="${package_lock}" \
|
|
node -p "require(require('node:path').resolve(process.env.VERCEL_CLI_LOCK)).packages['node_modules/vercel'].integrity"
|
|
)"
|
|
[[ "${vercel_integrity}" == "${expected_vercel_integrity}" ]] || {
|
|
echo "Pinned Vercel CLI integrity mismatch." >&2
|
|
exit 1
|
|
}
|
|
|
|
# Install with lifecycle scripts disabled before any credential is exposed to
|
|
# the CLI process. The committed lock fixes the complete dependency closure.
|
|
(
|
|
cd "${destination}"
|
|
npm ci \
|
|
--ignore-scripts \
|
|
--no-audit \
|
|
--no-fund \
|
|
--omit=dev
|
|
)
|
|
|
|
vercel_version="$(
|
|
VERCEL_CLI_ROOT="${destination}" \
|
|
node -p "require(require('node:path').join(process.env.VERCEL_CLI_ROOT, 'node_modules/vercel/package.json')).version"
|
|
)"
|
|
[[ "${vercel_version}" == "59.1.4" ]] || {
|
|
echo "Pinned Vercel CLI version mismatch: ${vercel_version}" >&2
|
|
exit 1
|
|
}
|
|
test -x "${destination}/node_modules/.bin/vercel"
|
|
vercel_cli="${destination}/node_modules/.bin/vercel"
|
|
|
|
echo "Materialized vercel@${vercel_version} from lock ${lock_sha256}."
|
|
if [[ -n "${github_output}" ]]; then
|
|
{
|
|
echo "cli=${vercel_cli}"
|
|
echo "integrity=${vercel_integrity}"
|
|
echo "lock_sha256=${lock_sha256}"
|
|
echo "version=${vercel_version}"
|
|
} >> "${github_output}"
|
|
fi
|